I created a new index in my splunk instance. I want to set some custom settings for event splitting in props.conf for the new index. which path should this props.conf go. Is it $SPLUNK_HOME/etc/apps/search/local or $SPLUNK_HOME/etc/system/local
Thanks in advance
Either will work.
If it was an index for a custom application, you'd probably put the definition in etc/<app>/local
But since you mention the search app, and you're unlikely to remove/disable it, it doesn't really matter.
I tend to keep the "permanent" stuff in system/local
Either will work.
If it was an index for a custom application, you'd probably put the definition in etc/<app>/local
But since you mention the search app, and you're unlikely to remove/disable it, it doesn't really matter.
I tend to keep the "permanent" stuff in system/local